DBS-C01 Deployment and Migration Practice Question
Network Topology
Refer to the exhibit. A company is creating an Aurora MySQL cluster using the AWS CLI. The command fails with an error. The company has a default KMS key but the command specifies a customer-managed KMS key. What is the most likely cause of the failure?
⚠ Common exam trap
A common mix-up: candidates assume the error is due to the key not existing or being in a different region, but the most common failure is an IAM permissions issue on the KMS key, especially when a customer-managed key is specified instead of the default AWS managed key.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The IAM user does not have permission to use the specified KMS key
The most likely cause of the failure is that the IAM user does not have the required permissions to use the specified customer-managed KMS key. When you specify a KMS key in the `--kms-key-id` parameter for an Aurora MySQL cluster, the IAM user must have `kms:CreateGrant`, `kms:Decrypt`, and `kms:Encrypt` permissions on that key. If the user lacks these permissions, the command fails even if the key exists and is in the correct region.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
The IAM user does not have permission to use the specified KMS key
Why this is correct
Permission to use the KMS key is required.
- ✗
The --kms-key-id parameter is not supported for aurora-mysql engine
Why it's wrong here
The parameter is supported for Aurora MySQL.
- ✗
The KMS key does not exist
Why it's wrong here
The key is specified as existing, but permissions may be missing.
- ✗
The KMS key is in a different region
Why it's wrong here
Cross-region KMS keys can be used, but the issue is likely permissions.
Go deeper
Related to this question
About these practice questions
One of 1,663 original DBS-C01 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This DBS-C01 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the DBS-C01 exam.